browser-metrics-plugin.contrib

{"schema_version":"1.7.4","id":"MAL-2026-17640","published":"2026-10-07T00:01:40Z","modified":"2026-10-08T03:52:20.224138063Z","summary":"Malicious code in browser-metrics-plugin.contrib (npm)","details":"browser-metrics-plugin.contrib is a dependency-confusion package: it is described as a \"Compatibility shim\", uses version numbers up to 99.0.1, and its README calls it an \"authorized dependency-confusion test\". Each listed version has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account xwise8887 published these 6 versions, and 7 versions of troubleshooting with the same payload, on 2026-10-07 between 00:01 and 00:07 UTC.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b1483de01fa77ef2e754624666b2c65ee4d2aff5ab261e38e3eb3f111b7efded)\nbrowser-metrics-plugin.contrib@1.0.1 ships beacon.cjs which POSTs a JSON payload containing os.hostname(), __dirname (install path), process.cwd(), and Node version to the hardcoded cleartext bare-IP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires twice: once from a postinstall lifecycle hook on npm install, and again at require time from index.js (the declared main), which calls require('./beacon.cjs').fire() at top level inside a try/catch. The module exports a Proxy of no-ops so that load failures do not break the surrounding build, concealing the beacon's presence. The second trigger ensures the callback fires even when scripts are disabled via --ignore-scripts. The combination of hardcoded bare-IP destination (no TLS, no domain), host identifier collection at install and import time, dual-trigger design, and silencing wrapper is the canonical dependency-confusion exfiltration shape. A README self-label as a 'research' or 'dependency-confusion test' package is author-controlled and does not constitute installer consent; the hostname and install path disclose internal corporate build infrastructure to a third party.\n","affected":[{"package":{"name":"browser-metrics-plugin.contrib","ecosystem":"npm"},"versions":["0.0.1","1.0.0","1.1.0","99.0.1","1.0.1","2.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beacon.cjs","sha256":"ecf3c6444166022b6982dd2a76e79379bc457c5fadb0d5885372c74dd5fcc778","tlsh":"883161eba8e4a0489eaa7098c54f0409b17bf4069401ab50fd5c82915f6197c33fa8dc"},{"path":"README.md","sha256":"b4f5478f42b53a0b482c1cd846ed7ec27ae2cf57a6e738b415905c37ccbaae0e","tlsh":"8bd02b347424653054284bf648a1b06957fcd2bcc42645b9585e5e0c544a768532777a"}],"package_integrity":[{"filename":"browser-metrics-plugin.contrib-99.0.1.tgz","hashes":{"sha1":"6d8ca12624667ec5718440c6e8b1f97b7f98abdc","sha512_sri":"sha512-Rr9PzrM5ZkjOYl5enckeUJ5T3Vtm1R40kTTuhcVpYpMWejgCj3P3WGmDpxHEQvUE5//grsZc29A67BLdPVDL0g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/browser-metrics-plugin.contrib"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/browser-metrics-plugin.contrib/v/99.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/browser-metrics-plugin.contrib/v/2.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/browser-metrics-plugin.contrib/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/browser-metrics-plugin.contrib/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/browser-metrics-plugin.contrib/v/1.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/browser-metrics-plugin.contrib/v/0.0.1"}],"database_specific":{"iocs":{"files":[{"digests":{"sha256":"a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d"},"note":"Main entry point; calls beacon.cjs fire() on import and exports a no-op Proxy. Identical in all listed versions.","paths":["index.js"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"88be31855364b43e29af8f413bf77718668e433e9b99ecff86af611f691efbba"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (browser-metrics-plugin.contrib@0.0.1).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"ecf3c6444166022b6982dd2a76e79379bc457c5fadb0d5885372c74dd5fcc778"},"note":"Executed by the postinstall script of browser-metrics-plugin.contrib@0.0.1.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"f685ef1fd4bf7e6c89a1d30f9a95fb2565bf43aef8926c47831ea406ce6ec68f"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (browser-metrics-plugin.contrib@1.0.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"ecf3c6444166022b6982dd2a76e79379bc457c5fadb0d5885372c74dd5fcc778"},"note":"Executed by the postinstall script of browser-metrics-plugin.contrib@1.0.0.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"91930c57df71a1daf5175de4fc1321cd2141a74d5e65ba65bb27f29d3fda5d4c"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (browser-metrics-plugin.contrib@1.1.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"ecf3c6444166022b6982dd2a76e79379bc457c5fadb0d5885372c74dd5fcc778"},"note":"Executed by the postinstall script of browser-metrics-plugin.contrib@1.1.0.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"ee6d3b15a0f508112999466fd4eb170cb891850297f3bed92d3d657937886d4f"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (browser-metrics-plugin.contrib@99.0.1).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"ecf3c6444166022b6982dd2a76e79379bc457c5fadb0d5885372c74dd5fcc778"},"note":"Executed by the postinstall script of browser-metrics-plugin.contrib@99.0.1.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"24fddf171255e79f57cafdc4f3f98f3b4beb61fd5f655c2dd2ac7ba2a657a678"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (browser-metrics-plugin.contrib@1.0.1).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"ecf3c6444166022b6982dd2a76e79379bc457c5fadb0d5885372c74dd5fcc778"},"note":"Executed by the postinstall script of browser-metrics-plugin.contrib@1.0.1.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"fd6ab85e9991034a33de280acf3acba5c15ea35210227017a764df9c420ff1e8"},"note":"postinstall script runs `node beacon.cjs`, which POSTs hostname, install path and cwd to http://185.158.107.175:8787/_ah/dc (browser-metrics-plugin.contrib@2.0.1).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"ecf3c6444166022b6982dd2a76e79379bc457c5fadb0d5885372c74dd5fcc778"},"note":"Executed by the postinstall script of browser-metrics-plugin.contrib@2.0.1.","paths":["beacon.cjs"],"source":"PACKAGE_ARCHIVE"}],"ips":["185.158.107.175"],"urls":["http://185.158.107.175:8787/_ah/dc"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-021130","import_time":"2026-10-08T03:50:29.902936689Z","modified_time":"2026-10-08T03:40:25Z","sha256":"5c14ea3f89a327e671b6bb6bfd27cb0db7fbc92f0777b89710442b792740d073","source":"amazon-inspector","versions":["99.0.1"]},{"id":"IN-MAL-2026-021114","import_time":"2026-10-08T03:50:28.789336342Z","modified_time":"2026-10-08T03:38:02Z","sha256":"8123f97c3618eb20a66da2dfb8a45256e76fb1c84c4a17ce844dac7a2389bfe6","source":"amazon-inspector","versions":["2.0.1"]},{"id":"IN-MAL-2026-021107","import_time":"2026-10-08T03:50:28.33757488Z","modified_time":"2026-10-08T03:36:55Z","sha256":"add156e4ab0c336588911b9741dc7b10a5b1471d4b094e2410c5325ceecb3401","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-021108","import_time":"2026-10-08T03:50:28.395578472Z","modified_time":"2026-10-08T03:37:06Z","sha256":"b1483de01fa77ef2e754624666b2c65ee4d2aff5ab261e38e3eb3f111b7efded","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-021110","import_time":"2026-10-08T03:50:28.532299242Z","modified_time":"2026-10-08T03:37:22Z","sha256":"ba360d12dd9384c50c52bb7367dcee82bc20aa303178b4782e9f2fb8b823f5c6","source":"amazon-inspector","versions":["1.1.0"]},{"id":"IN-MAL-2026-021109","import_time":"2026-10-08T03:50:28.455278516Z","modified_time":"2026-10-08T03:37:14Z","sha256":"d92366e7357cc9d42be3e33965b1c6bac85403f0b3f1fc079e33e81b81b61827","source":"amazon-inspector","versions":["0.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}